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In the Claims : 

This listing of claims will replace all prior versions and listings of claims in the 
application. 

1 . (Original) A method of detecting a class of viral code, comprising: 
heuristically analyzing a subject file to generate a set of flags along with statistical 

information; 

using the set of flags with statistical information to perform at least one search for a scan 
string and/or a statement type in the subject file; and 

triggering a positive detection alarm if each of the at least one search is found at least a 
corresponding predetermined number of times. 

2. (Original) The method of claim 1, wherein the subject file includes source code 
in a predetermined programming language. 

3. (Original) The method of claim 2, wherein the predetermined programming 
language is a script language. 

4. (Original) The method of claim 1 ? wherein the subject file includes a file for a 
predetermined word processor. 

5. (Original) The method of claim 1 ? wherein at least one flag in the set of flags 
corresponds to a copy operation associated with one of the class of viral code. 
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6. (Original) The method of claim 1, wherein at least one flag in the set of flags 
corresponds to an operation for adding data from a string to a target module. 

7. (Original) The method of claim 1, wherein at least one flag in the set of flags 
corresponds to an operation for importing another code. 

8. (Original) The method of claim 1, wherein at least one flag in the set of flags 
corresponds to an operation for disabling virus protection features in a target application. 

9. (Original) The method of claim 1, wherein the searched statement type 
corresponds to an operation for disabling functionalities in a target application. 

10. [12] (Amended) The method of claim 1, wherein the searched statement 
type corresponds to an operation for overwriting system macros. 

1 1 . (Original) A program storage device readable by a machine, tangibly embodying 
a program of instructions executable by the machine to perform method steps for detecting a 
class of viral code, the method steps comprising: 

heuristically analyzing a subject file to generate a set of flags along with statistical 
information; 

using the set of flags with statistical information to perform at least one search for a scan 
string and/or a statement type in the subject file; and 
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triggering a positive detection alarm if each of the at least one search is found at least a 
corresponding predetermined number of times. 

12. (Original) A computer system, comprising: 

a processor; and 

a program storage device readable by the computer system, tangibly embodying a 
program of instructions executable by the processor to perform method steps for detecting a class 
of viral code, the method steps comprising: 

heuristically analyzing a subject file to generate a set of flags along with 
statistical information; 

using the set of flags with statistical information to perform at least one search 
for a scan string and/or a statement type in the subject file; and 

triggering a positive detection alarm if each of the at least one search is found at 
least a corresponding predetermined number of times. 

13. (Original) A computer data signal embodied in a transmission medium which 
embodies instructions executable by a computer for detecting a class of viral code, comprising: 

a first segment including heuristic analyzer code to analyze a subject file to generate a set 
of flags along with statistical information; 

a second segment including scanner code using the set of flags with statistical 
information to perform at least one search for a scan string and/or a statement type in the subject 
file, and triggering a positive detection alarm if each of the at least one search is found at least a 
corresponding predetermined number of times. 
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14. (Original) An apparatus for detecting a class of viral code, comprising: 

an heuristic analyzer, wherein the heuristic analyzer analyzes a subject file to generate a 
set of flags along with statistical information; 

a search component, wherein the search component uses the set of flags with statistical 
information generated by the heuristic analyzer to perform at least one search for a scan string 
and/or a statement type in the subject file, and triggers a positive detection alarm if each of the at 
least one search is found at least a corresponding predetermined number of times. 

15. (Original) The apparatus of claim 14, wherein the heuristic analyzer is rule- 
based and comprises a heuristic engine and heuristic rules. 

16. (Original) The apparatus of claim 15, wherein the heuristics engine, using 
heuristic rules, parses the subject file. 

1 7. (Original) The apparatus of claim 15, wherein the heuristics rules include sets of 
heuristic flags stored in a rules table. 

1 8. (Original) The apparatus of claim 14, wherein the search component is rule- 
based and comprises a search engine and viral code class rules. 

19. (Original) The apparatus of claim 14, wherein the search component is a neural 
network. 
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